Patch Tuesday November 2026: 1,093 fixes, 1 exploited. What to patch first

This article first appeared on varaxontech.com, where it is kept up to date.

The short version

• Microsoft released fixes for 1,093 of its own CVEs on 10 November 2026, after a record 1,408 in October. Over the last four Patch Tuesdays that is 3,875 CVEs.
• Only 6 of those 3,875 (0.15%) are on CISA's Known Exploited Vulnerabilities (KEV) list. None of the 6 was rated Critical by Microsoft. November's one exploited bug, in Outlook, is rated Moderate.
• If you patched only what Microsoft calls Critical, you would have fixed 297 CVEs and missed all 6 that attackers actually used.
• A better order: KEV first, then internet-facing systems, then high EPSS, then severity. EPSS put the Outlook bug 7th of 1,093 this month, while its severity label put it near the bottom.

Patch Tuesday used to be a list you could read over coffee. In August 2026 Microsoft released 402 of its own CVEs on Patch Tuesday. In September it was 972, in October 1,408, and on 10 November 1,093. Nobody reads a thousand advisories a month, and nobody patches a thousand things in order of severity either.

So we counted. This page takes Microsoft's own monthly security update data for the last four Patch Tuesdays, checks every CVE against CISA's KEV catalog and FIRST's EPSS scores, and asks one question: which signals would have pointed you at the bugs attackers actually used? The method is at the end, and you are welcome to reuse the numbers with a link back.

November 2026 Patch Tuesday in numbers

Microsoft-assigned CVEs released on 10 November 2026 (Microsoft update data; KEV catalog 2026.11.13; EPSS 14 November 2026)

Microsoft's monthly document also lists 548 more CVEs that other organisations issued for open-source parts Microsoft ships, such as the Chromium engine in Edge. Two of those are on KEV this month: the Chromium bug CVE-2026-125350 and the OpenSSH bug CVE-2026-123158. They are not in our counts, but they belong on your list.

The one that matters: the Outlook zero-day (CVE-2026-124194)

CVE-2026-124194 is the only November bug Microsoft marked as exploited, and CISA added it to KEV on the same day with a federal deadline of 24 November. In Microsoft's description, an attacker sends a crafted file and persuades someone to open it in Outlook. Outlook then connects to a server the attacker controls without showing its usual external-content warning, and that leaks the user's NTLMv2 password hash, which can be used to sign in as them.

• Severity: Moderate, CVSS 6.5. It needs the user to open the file, and Microsoft says the Preview Pane is not a way in. On paper that sounds minor.
• In practice it is a credential theft bug that attackers were already using. That is why it is the first thing to patch this month, ahead of every Critical on the list.
• What to do: install the November Office and Outlook updates, then confirm on a sample of machines that the update is really there. If you can, also block outbound SMB (TCP 445) to the internet, which limits this whole class of hash-leak attacks.

Four months of Patch Tuesday: severity missed every exploited bug

Microsoft-assigned CVEs released on each Patch Tuesday, August to November 2026

All six exploited CVEs were rated Important or Moderate. Four were privilege-escalation or bypass bugs in Windows, the kind attackers chain after they already have a foothold, and one was the Outlook credential leak. The sixth is a useful warning:

"Exploitation less likely" is a forecast, not a promise: Microsoft released the SharePoint bug CVE-2026-65660 on 11 August, rated Important and marked "exploitation less likely". CISA added it to KEV on 25 September, 45 days later, with a 3-day deadline. If your process only revisits a month when Microsoft flags exploitation on release day, that one slips through.

The six exploited CVEs from August to November 2026 (Microsoft update data, CISA KEV, EPSS on 14 November 2026)

What EPSS got right, and where it falls short

EPSS estimates the chance a CVE will be exploited in the next 30 days. It did better than severity here, with a catch.

• It ranks well. On 14 November the Outlook zero-day had an EPSS score of 1.6%, which sounds tiny, but only six of November's 1,093 Microsoft CVEs scored higher. Sorted by EPSS, it is on the first screen. Sorted by severity, it is near the bottom.
• Its numbers look small. Not one of the 3,875 CVEs from these four months scores 10% or more today, not even the exploited ones. If your rule is "patch anything over 10%", you would patch none of them. Use EPSS to rank, not as a pass mark.
• It lags. EPSS learns from what it sees. Across all of 2026, 81% of the CVEs CISA added to KEV had no EPSS score or a score under 10% the day before they were listed (CISA KEV statistics). KEV tells you what has happened; EPSS tells you what is likely. You want both.

A patch order that would have caught all six

1. Anything on CISA's KEV list, now. Check every month's KEV additions against your whole estate, not just the latest Patch Tuesday, so late listings like the SharePoint bug get caught. Our Exploited now page lists the last 30 days.
2. Internet-facing systems next. A remote code execution bug on an exposed Exchange, SharePoint or RD Gateway server is a different emergency from the same bug on an internal desktop.
3. Then sort the rest by EPSS, highest first, and give the top 1 to 2% a short deadline.
4. Then severity, to break ties and to plan the routine monthly rollout.
5. Rescan and prove it. A patch that was deployed is not the same as a patch that installed. Rescan, compare against the last scan, and close only what the scan shows is gone.

That is the order Varaxon Scan Hub uses when it builds a report from your scan export: KEV findings first, then EPSS, then severity, with each finding showing the evidence behind its place in the list. You can try the same ordering on a single CVE with the free CVE checker, or read more about the approach in risk-based vulnerability management.

How we counted

• Source: Microsoft's public monthly security update documents for August to November 2026 (the CVRF data behind the Security Update Guide), read on 14 November 2026.
• What counts as a CVE here: CVEs Microsoft itself assigned, first released on the Patch Tuesday date. CVEs Microsoft added later in the month, and CVEs other organisations assigned for third-party components, are left out. That is why our totals can differ slightly from other write-ups.
• Critical: the CVE has a Critical rating for at least one affected product in Microsoft's data.
• Exploited: on CISA's KEV catalog, version 2026.11.13. Microsoft's own "exploited" flag matched KEV for five of the six; the sixth (CVE-2026-65660) was listed by CISA later.
• EPSS: FIRST's EPSS API, scores dated 14 November 2026.

We will add December's numbers after the next Patch Tuesday on 8 December 2026.

Common questions

When was Patch Tuesday in November 2026?

Tuesday 10 November 2026. Microsoft releases its monthly security updates on the second Tuesday of each month. The next one is 8 December 2026.

How many vulnerabilities did Microsoft fix in November 2026?

1,093 CVEs that Microsoft itself assigned were released on 10 November 2026, 63 of them rated Critical. Microsoft's monthly document also lists 548 CVEs from other organisations for third-party components such as Chromium.

Was there a zero-day in the November 2026 Patch Tuesday?

Yes, one: CVE-2026-124194, an Outlook spoofing bug that leaks the user's NTLMv2 hash. Microsoft marked it as exploited and CISA added it to KEV on 10 November with a 24 November deadline for US federal agencies.

Should I patch Critical vulnerabilities first?

Not by default. From August to November 2026, none of the six Microsoft CVEs that attackers used was rated Critical. Patch anything on CISA's KEV list first, then internet-facing systems, then the highest EPSS scores, and use severity to plan the rest.

Originally published at https://varaxontech.com/guides/patch-tuesday-november-2026-what-to-patch-first. Varaxon Scan Hub turns vulnerability scan exports into evidence-led client reports, ranked by CISA KEV and EPSS.